List Findings

Overview

Returns every security finding the analysis engine has persisted for a domain. Each row carries:

• Classification — severity (critical/high/medium/low/info), category (vulnerability, infrastructure, email_security, …), and the rule-engine finding_type.
• Status timeline — status (new/acknowledged/false_positive/resolved/ignored), detected_at, verified_at.
• Affected asset — polymorphic reference (type + identifier). The identifier is always returned; it is null only for domain-level findings that have no specific asset.
• CVE block — when the underlying finding is vulnerability-class, a flat cve object is surfaced with the identifier (CVE / GHSA / OSV / WPSCAN id), CVSS score and vector, EPSS probability + percentile, and exploit/patch availability flags.
• Estimated EUR impact — a per-finding monetary estimate (estimated_impact_eur) derived from the user's sector and employee-size bucket.

The response also includes a summary block (faceted counts — see below) and a financial_impact aggregate so a dashboard can render risk distribution and total exposure without paginating through every row.

Asset visibility

Affected-asset identifiers and identifier-bearing evidence keys (subdomain names, email addresses, file paths, usernames, person names, internal IPs, phone numbers, CNAME targets) are returned in full to any user with access to the domain — everything the platform surfaces is public OSINT, so there is no ownership wall.

Per-row title and description come from the localised findings catalog (see language), not from the DB. That keeps the copy generic and produces natural Spanish/Catalan copy when language=es|ca.

CVE, CVSS, EPSS, technology name + version, breach counts, and externally observable signals (server header, TLS posture, DMARC/SPF reasons, etc.) are likewise visible.

Facet counts

Each facet's chip counts ignore that facet's own selection, so a UI can render counts that mean "what the list would become if I picked this filter":

• summary.by_severity and summary.with_cve ignore the severity and with_cve selections — they count over the domain + status + q + category set.
• summary.by_category ignores the category selection — it counts over the domain + status + q + severity + with_cve set.
• summary.total and the paginated findings[] reflect the fully-filtered set.

Financial-impact methodology

Methodology version: ibm-2025-eur-v2.

Each finding gets a per-row EUR contribution computed as:

baseline_eur(sector, employees) × severity_fraction[severity]

• Sector baselines come from the IBM Cost of a Data Breach Report 2025 per-industry average breach cost, mapped to NIS2 sectors. Unknown / unmapped user-supplied sectors fall back to the global average (other).
• Employee-size multiplier scales the sector baseline by the user's employees bucket. Unknown / unmapped buckets fall back to 1.00.
• Severity → fraction-of-baseline: critical 0.20, high 0.075, medium 0.02, low 0.003, info 0. A single finding's contribution is therefore bounded at 20 % of the sector baseline.

Employee-size multiplier

Aggregation — per_finding_type_capped

financial_impact.total_eur does not add the per-row EUR for every finding. Instead:

1. Group findings by finding_type.
2. Within each group, take the highest severity fraction — duplicates of the same risk class collapse to a single contribution (an attacker only needs to exploit one instance of a class to realise that risk).
3. Sum the per-type contributions.
4. Clip the total at one full sector baseline (baseline_eur). by_severity_eur is scaled proportionally when the cap fires so the breakdown still sums to the cap.

The per-row estimated_impact_eur stays as the unaggregated severity × baseline value — useful for ranking individual rows by exposure.

Figures are model-derived estimates, not actuarial losses — they exclude regulatory fines (GDPR / NIS2: up to EUR 10 M or 2 % of turnover) and ransom payments, which can dwarf the recovery cost the catalog represents.

Path Parameters

Query Parameters

Response

{
  "findings": [
    {
      "id": 18342,
      "finding_type": "subdomain_takeover",
      "severity": "high",
      "category": "infrastructure",
      "title": "Subdomain Takeover Risk",
      "description": "One or more subdomains point to external services that are no longer claimed or have been decommissioned. These dangling DNS records can be exploited by attackers to take control of the subdomain.",
      "status": "new",
      "detected_at": "2026-05-01T10:00:00Z",
      "verified_at": "2026-05-05T08:00:00Z",
      "affected_asset": { "type": "subdomain", "identifier": "legacy.example.com" },
      "cve": null,
      "evidence": {
        "cname": "abandoned.s3.amazonaws.com",
        "is_external_cname": true
      },
      "conditions_met": ["cname_external", "no_active_target"],
      "estimated_impact_eur": 383640
    }
  ],
  "summary": {
    "total": 87,
    "by_severity": { "critical": 5, "high": 12, "medium": 30, "low": 30, "info": 10 },
    "by_category": { "vulnerability": 14, "email_security": 10, "infrastructure": 18 },
    "with_cve": 14,
    "page": { "limit": 100, "offset": 0, "next_offset": null }
  },
  "financial_impact": {
    "sector_key": "finance",
    "sector_label": "Finance",
    "sector_known": true,
    "employee_tier": "1000+",
    "employee_tier_label": "enterprise",
    "employee_multiplier": 1.00,
    "baseline_eur": 5115200,
    "total_eur": 2438700,
    "by_severity_eur": {
      "critical": 1023040,
      "high": 1151670,
      "medium": 263990,
      "low": 0,
      "info": 0
    },
    "currency": "EUR",
    "methodology_version": "ibm-2025-eur-v2",
    "source": "IBM Cost of a Data Breach Report 2025; NIS2 sector mapping",
    "aggregation_method": "per_finding_type_capped",
    "caveats": [
      "estimate-not-actuarial",
      "excludes-fines-and-ransom",
      "usd-to-eur-2025-ecb",
      "per-finding-type-aggregation"
    ]
  }
}

Response Fields